Hermes Agent Assess
Overview
Hermes Agent is an open-source, self-improving personal agent from Nous Research that combines tool use, persistent memory and self-written skills for autonomous task completion (Hermes Agent). It runs as a CLI, a desktop app or a long-running gateway reachable from messaging apps, and it can still generate trajectories for training tool-calling models (Hermes README).
Assess for experimentation only. Do not run it as a shared or production service without OS-level isolation, pinned versions and a security review.
Adoption Signals
- The repository has about 250,000 stars and 53,000 forks as of 30 September 2026, under the MIT licence (Hermes Agent on GitHub).
- Hermes Agent ranked first by token usage in OpenRouter's app and agent rankings when checked on 30 September 2026 (OpenRouter app rankings).
- The
hermes-agentpackage published by Nous Research had about 139,000 PyPI downloads in the 30 days to 30 September 2026, although the main install path is a shell installer (PyPI Stats). - Releases ship roughly every week, with eight in August and five in September 2026 up to v0.21.5 on 24 September (Hermes Agent releases).
- The CLI includes a
hermes claw migratecommand for users moving from OpenClaw, and skills follow the agentskills.io format (Hermes README).
Risks
- Host-level execution by default. The security policy states that nothing inside the agent process, including the approval gate and pattern scanners, constitutes containment, and that the default terminal backend runs commands directly on the host (Hermes security policy).
- Known vulnerabilities. NVD lists injection flaws in the skills tool (CVE-2026-10220) and memory tool (CVE-2026-10223) in versions up to 2026.4.30, and a protection-mechanism failure in the TUI gateway's shell execution up to 0.15.2 (CVE-2026-14625); the records state that the vendor did not respond to early disclosure, and the project runs no bug bounty (Hermes security policy).
- Persistent self-modification. Skills the agent writes and memory it curates survive across sessions, so a successful prompt injection can persist, and behaviour cannot be reproduced from a fixed configuration.
- Data leaving controlled channels. The gateway connects a shell-capable agent to Telegram, Discord, Slack, WhatsApp and Signal (Hermes README), which conflicts with most corporate data-handling and GDPR processing records.
- Release churn. Roughly weekly releases leave little time to review changes before upgrading.
Pros & Cons
Advantages
- A persistent learning loop is built in: the agent writes and refines its own skills, curates memory and searches past sessions, which makes it a useful reference for studying long-lived personal agents.
- Model- and platform-agnostic under the MIT licence: it works with Nous Portal, OpenRouter, OpenAI or custom endpoints and can run commands locally, in Docker, over SSH or in cloud sandboxes such as Modal and Daytona.
- Very large and active community: about 250,000 GitHub stars by September 2026, releases roughly every week, and the top spot in OpenRouter's app rankings by token usage.
Disadvantages
- The project's own security policy defines it as a single-tenant personal agent whose only security boundary against an adversarial model is the operating system; the default terminal backend runs commands directly on the host.
- Several 2026 CVEs with public exploits cover injection in the skills and memory tools and a protection bypass in the TUI gateway's shell execution.
- Self-written skills, persistent memory and chat-app gateways (Telegram, WhatsApp, Slack and others) make its behaviour hard to audit and move data outside enterprise controls.
Recommendation
Hermes Agent stays in Assess. It is worth studying for its learning loop, skill creation and multi-channel design, and for comparing with OpenClaw, which targets the same personal-agent use case. Run any evaluation on a dedicated machine or with a non-default terminal backend (Docker, a remote host or a cloud sandbox), with test accounts, no corporate credentials, no production data and no connection to company messaging workspaces.
Do not deploy it as a shared team service or connect it to regulated data: the project itself describes a single-tenant trust model. Teams that want the underlying ideas in production should take the patterns, such as reviewed skills, scoped memory and sandboxed execution, into a governed agent framework with identity, audit logging and change approval.
Sources
Консалтинг
От радара к внедрению
Вы оценили технологии — мы помогаем безопасно и измеримо внедрить их в продуктивные системы.
